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The implementation and evaluation of an efficient method for estimating safe aircraft 
maneuvering envelopes are discussed. A Bayesian approach is used to produce a determin- 
istic algorithm for estimating aerodynamic system parameters from existing noisy sensor 
measurements, which are then used to estimate the trim envelope through efficient high- 
fidelity model-based computations of attainable equilibrium sets. The safe maneuverability 
limitations are extended beyond the trim envelope through a robust reachability analysis 
derived from an optimal control formulation. The trim and maneuvering envelope limits 
are then conveyed to pilots through three axes on the primary flight display. To evaluate 
the new display features, commercial airline crews flew multiple challenging approach and 
landing scenarios in the full motion Advanced Concepts Flight Simulator at NASA Ames 
Research Center, as part of a larger research initiative to investigate the impact on the 
energy state awareness of the crew. Results show that the additional display features have 
the potential to significantly improve situational awareness of the flight crew. 


I. Introduction 

I N all transportation systems, but especially in civil aviation, safety is of paramount importance. Many 
developments focus on improving safety levels and reducing the risks of life threatening failures. In a recent 
study by the Commercial Aviation Safety Team (CAST) and the International Civil Aviation Organization 
(ICAO), it can be observed that loss of control in flight (LOC-I) is the most frequent primary accident 
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cause.'--- LOC-I accidents have a variety of contributing factors, occurring individually or in combination, 
such as a system malfunction, atmospheric disturbances (e.g. turbulence or icing), and loss of situational 
awareness by the crew. An important aspect during operations under system malfunction or atmospheric 
disturbance is that the crew needs to maintain awareness through possibly time changing degradation of 
aircraft performance characteristics. The CAST established a specialized international safety analysis team 
to study the apparent growing trend in loss of Airplane State Awareness (ASA) by the flight crew. This team 
has produced recommended safety enhancements that include the research, development, and implementation 
of technologies for enhancing flight crew awareness of airplane energy state (SE 207 )P The research presented 
in this paper provides a means to address these recommendations by interfacing on-board safe flight envelope 
estimation capability with cockpit displays and testing them on commercial airline crews tasked with flying 
challenging approach and landing scenarios. 

In full generality, the safe flight envelope is an entire set of safe aircraft state and control input combina- 
tions. Because of the underlying nonlinear aircraft dynamics, it is challenging to accurately map this set fast 
enough to provide the pilot or automation system with reliable information that reflects diverse and rapidly 
changing aircraft operational conditions. A variety of methods for tackling this challenge have been investi- 
gated in previous studies covering wind tunnel testing, flight test experiments, and high-fidelity model-based 
computation.® 4 AGD The approach proposed in this paper, builds on previous work, where the trim envelope 
is estimated through efficient high-fidelity model-based computations of attainable equilibrium sets, which in 
turn depend on aerodynamic coefficient identification from air data, inertial, and GPS measurements. The 
safe maneuverability limitations are then extended beyond the trim envelope through a robust reachability 
analysis derived from an optimal control formulation that leverages the principle of time scale separation. 
The theoretical details covering this approach in-depth are available in previous publications EIIIIOD 

This paper is focused on applying the previously developed theory to the practice of conveying mean- 
ingful aircraft state awareness information to the crew. This is accomplished by translating the trim and 
maneuvering envelope boundaries to indicators for three axes on the primary flight display, namely for air- 
speed, vertical speed, and bank angle, in a manner that leverages existing conventions already familiar to 
commercial pilots. The impact on the energy state awareness of the crew was then evaluated in the full mo- 
tion Advanced Concepts Flight Simulator at NASA Ames Research Center. Commercial airline crews flew 
multiple problematic approach and landing scenarios simulating the airspace around Memphis International 
Airport. 

The structure of this paper is as follows. In Sec. un the method for estimating the trim and maneuvering 
envelopes is summerized from previous research. The presentation of information to the crew is elaborated 
in Sec. uni The experiment method is described in Sec. El Sec. 0 discusses the results. Conclusions and 
recommendations can be found in Sec. ED 

II. Estimation of the envelope boundaries 

The safe maneuvering envelope is a fundamental property of the aircrafts design and overall current state 
of health. By definition it determines the overall capability of the aircraft. If actively monitored in time, 
it may function as an early warning system as well as provide anticipatory guidance to help avoid loss of 
control. Improved methods for tracking aircraft maneuverability in real-time may therefore effectively help 
pilots avoid inappropriate crew response and further prevent or recover aircraft from upset conditions. 

This section summarizes in some detail our previous work on developing computationally efficient methods 
for on-board envelope estimation from real-time aircraft sensor data. This capability provides the underlying 
information required in Sec. ED for constructing new primary flight display features. 

A. Mathematical model postulation and parameter identification 

The aircraft model used for the simulator study discussed later in this paper, is the Advanced Concepts 
Transport (ACT) model, which is representative of a mid-size, two-engine, jet transport aircraft as shown 
in Fig. [T( a)| It has the general characteristics of a wide-body, T-tail, low wing airplane with twin turbofan 
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engines located under the wings, and physical dimensions similar to those of a Boeing 757 aircraft.^ The 
full simulation model is based on a Lockheed-Georgia Company commercial transport concept developed in 
1983, which was designed as a platform for testing advanced aircraft simulator concepts with active flight 
controls, representative of modern fly-by-wire control systems. 

Given this high fidelity simulation model, the goal in this subsection is to develop a reduced complexity 
model that allows one to study particular characteristics of the higher fidelity model in a computationally 
efficient manner. For the application of interest, this is best accomplished by using the principle of time 
scale separation to find a mathematical description of the flight dynamics focused on the variables that drive 
the slow dynamics of the aircraft state. The basic concept is depicted in Fig. |l(b)] which illustrates that the 
nine dimensional nonlinear problem, relating thrust and control surface deflection to the angular rates and 
ultimately the velocity vector in polar coordinate form, is decomposed into three coupled mappings between 
high, middle, and low bandwidth variables. 
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Figure 1. 


The reduced complexity model is developed from the physical relationships between the low bandwidth 
variables, where net engine thrust T, angle of attack a, side-slip angle /3, and roll angle /> are treated as 
known virt-ual inputs. The aircraft state vector of interest is then comprised of the total air speed V, and 
flight path angle 7 . After making use of the small angle assumption for a and /3 one obtains the following 
expression for the aircraft state dynamics, 
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where g is the acceleration due to gravity, m is the mass of the aircraft, S is the net wing surface area, 
and p is the air density. For the particular simulation discussed in this paper, the following fixed constants 
were assigned: m = 90719 kg, g = 9.802 m/s 2 , and S = 181.25 m 2 . The altitude dependent air density p 
was assumed known according to the U.S. Standard Atmosphere published in Ref. till Furthermore, within 
this setup, the aerodynamic coefficients take into account the influences of the secondary control surface 
deflections: 


C Do = C Do + C DSa S a + C D6sp J sp + C Dsa <5fi + C Dsig Jig 

CD a = CD a + 

Cl 0 = Cl 0 + C Ls J a + Cl 5sp S S p + C'L Sg Jfl + 

where the deflections due to ailerons, spoilers, flaps, and landing gear are provided by J a ,Jsp>JfP and £>i g , 
respectively. The influence of the ailerons on lift and drag are typically negligible for conventional aircraft 
configurations. However, for the ACT design, we found that aileron deflection had a significant impact on 
lift and drag. For that reason, terms to cover aileron effects were included in the model equations above. 
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An important practical aspect of this reduced complexity model is that it is affine with respect to the 
aerodynamic coefficients. 

In general, models for the pitching moment coefficient are aircraft type dependent. For the ACT simulator 
model in particular, the model expression was developed through a standard model structure selection 
analysis.^ 2 13 The resulting expression was 
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where c is the mean aerodynamic chord, q is the current pitch rate, S e is the elevator deflection, and *h is 
the stabilizer deflection. A more detailed derivation of Eq. © and Eq. © is available in Ref. 1141 [TODO: 
check EuroGNC paper citation] 


B. Aerodynamic Parameter identification 

Ultimately, we want to find a way to use Eq. © and Eq. © to numerically characterize the safe flight 
envelope for a particular aircraft. This task however, first requires the aircraft type and flight condition 
dependent aerodynamic coefficients that constitute the vectors 

c = (c Do , C D ga , c Dssp , c Dsa , c Dlig , C Da , c DaSn , C Lo , C La , C Lga , c Lssp , c Lsa , c Lsi ^j , 

and 

m = (Cm 0 ) C ma , C’m a2 , C’m qc ; C mg(j , C m , C mi ^ , C mT , C ms ^ , C mg ^ p , ^ . 

The estimation of these vectors is accomplished through a system identification step that essentially fits the 
above described dynamics model to any particular aircraft, or higher fidelity simulation model, such as the 
ACT model. 


1. Sensor Information 

An inertial sensor package, consisting of rate gyros and accelerometers, provides angular rates and accel- 
erations as well as specific forces. It is assumed that a state estimation algorithm is available, taking into 
account sensor disturbances (biases and/or noise), and compensating for them.E3 

2. Bayesian Inference Approach 

A specialized Bayesian probabilistic approach was developed to infer the unknown aerodynamic coefficients 
from the noisy sensor measurements and to quantify the estimation uncertainty. With this approach the 
forward model provided by equations Eq. © and Eq. © is used to define a noisy sensor measurement 
process, which then enables one to derive the posterior pdf 

p(c, S | Observed Data) (3) 

that specifies the probability density of the unknown parameter values c and inverse measurement noise 
covariance matrix S, given the relevant history of observed data and prior information. With the modeling 
and additive noise assumptions used in the derivation, the posterior pdf Eq. © is log-concave in either c or S 
when the other variable is held fixed. This enables the efficient computation of a local optimal estimate using 
a deterministic block coordinate descent method to break the solution process into steps that require solving 
simple convex optimization problems. Furthermore, the coefficient parameter estimation uncertainty and 
Bayesian model evidence can also be estimated using closed form expressions. Significantly, more information 
about the identification procedure is available in Ref. 121 
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C. Estimation of the trim envelope 

One important feature of the reduced complexity model Eq. (HD is that it enables a rapid numerical analysis 
of the set of trimmable aircraft states, 


{x | f (x, u; c) = 0, (x, u)e6}, (4) 

where f(x, u;c) implements the right hand side of Eq. © with state vector x = (V, 7 ), and input vector 
u=(T, a, j3, 0, S a , <5 sp , dfl, 5i g ). The set B contains all allowable states and virtual inputs. The trim envelope 
defined by Eq. © is important because it represents an a-priori safe flight envelope. 

With the reduced complexity model, and a given aerodynamic parameter vector c, characterizing the 
set of trimmable points then involves setting the top and bottom equations on the right hand side of © 
equal to zero. The bottom equation is solved for angle of attack a in terms of the other variables in that 
equation, which do not include thrust T. The top equation is then solved for T into which we substitute 
the previous solution for a. The result is a closed form solution for the required thrust and alpha needed 
to achieve trim for any given state vector x and fixed values for the other virtual inputs /3 and (f > , as well as 
control surface deflections i5 a , 5 sp , <5fl, and <5i g . If it turns out that the required (T, a) pair falls within £>, then 
x is a trimmable state. In all, this process enables one to code a computationally efficient indicator function 


X(x) 


1 if x E Trim Envelope, 
0 otherwise. 


(5) 


The trim envelope is then revealed by using I{x) to filter any grid of test aircraft state vectors down to 
those for which a trim condition is achievable within minimum and maximum constraints on x and u. In 
addition, one should check whether the achieved trim points are stable. This involves checking the eigenvalues 
associated with the local linear approximation to Eq. © at each trim point, and as before, a closed form 
expression can be found. 

For fixed aircraft configuration, roll angle, and side-slip angle, the virtual inputs are thrust and angle of 
attack. Figure [2(a) | illustrates how the constraints on these inputs determine the envelope boundaries. The 
minimum speed boundary corresponds to the maximum angle of attack at which stall occurs. The maximum 
speed boundary is determined either by the minimum permissible angle of attack, or by the maximum 
sustainable structural load, whichever requires the slower speed. The upper and lower flight path angle 7 
boundaries are defined by the maximum and minimum net excess thrust over drag, respectively. The upper 
flight path angle boundary, which defines 7 max, would have a similar shape as the lower boundary for 7 m i n , 
but a set of unstable trim points has been left out of the envelope at the upper boundary, which makes it 
distinctly different in shape than the lower boundary, and which further makes the back side of the power 
curve effect less apparent P 


D. Estimation of the maneuvering envelope 

Even under normal operations, aircraft can and do safely exit and return to the trim envelope, especially 
during the descent phase of flight. Therefore, the preferred definition of the maneuvering envelope should 
be the set of states that the aircraft can safely attain, and from which it can recover back to trim. Finding 
this set, requires solving for the forward and backward reachable sets. The forward reachable set contains 
the states that can be reached from at least one point in the trim envelope. The backward reachable set 
contains the initial states from which one can maneuver the aircraft back to the trim envelope. The safe 
maneuvering flight envelope is then defined as the intersection of these forward and backward reachable 
sets. This interpretation is illustrated in Fig. |2(b)[ In addition to its contribution to the safe maneuvering 
envelope, the backward reachable set is also considered a survivable flight envelope. After an upset due to 
damage, turbulence, wake encounter etc., it is possible to bring the aircraft back to a safe trim condition as 
long as the current flight condition is situated inside the backwards reachable set. 

Previous work has rigorously shown that reachability based maneuvering envelopes can be calculated by 
first reformulating the problem within an optimal control framework, 1 ® and then using level set methods to 
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complete the calculation. 7 ® ^ In addition, robustness with respect to uncertainty in the identified model is 
readily incorporated into the solution process. 




(b) Maneuvering Envelope 


Figure 2. (a) (V, 7 ) trim envelope for ACT model at 15,000 ft. (b) Safe maneuvering envelope as intersection 
between forwards and backwards reachability, modified from source: van Oort® 


E. Example trim and maneuvering envelopes 

The basic affects of altitude and aircraft configuration on the trim and maneuvering envelopes are shown 
in Fig. [3] Figure EJa) shows the envelope for the clean aircraft configuration at 15,000 ft. In Fig. [3jb) the 
altitude is increased to 30,000 ft, which causes the envelope to shrink because the reduced air density at 
higher altitude decreases lift, drag, and maximum engine thrust authority. Flap deployment increases the 
lift, drag, and maximum angle of attack while also requiring slower maximum airspeed due to structural 
limitations with flap extension. The resulting combination of these effects, which enable the aircraft to 
safely sustain slower airspeed, is shown for full flap deployment in Fig. He). Adding gear and spoilers 
further increases drag, and by comparing He) to Hd) one observes that greater descent angles are possible 
at higher airspeed. 


F. Pitching moment control authority for a fixed stabilizer position 

Depending on the stabilizer position and elevator authority, there may be stricter upper limits on speed and 
climb rate combinations than those produced by the limits on a and T discussed above. This important 
information can be incorporated into the trim envelope by adding consideration of the moment equation Eq. 
©• At any particular trim condition one can assume a, T, *h, <5 a , <5 sp , <5fl, and <5i g are fixed and q = 0. By 
setting the left hand side of Eq. © to zero one observes that a specific elevator input 5 e is then required 
to balance the equation. If the required i5 e falls within the elevator control envelope, then the trim point 
remains a viable option; otherwise, the point must be removed from the envelope. 

For small to moderate stabilizer positions the elevator saturation limits have no impact on the shape of 
the trim envelope. However, for large stabilizer deflection angles the effect can be significant as shown in Fig. 
H With the stabilizer position set to 0°, Fig. 4(a) shows that the elevator deflections required to balance 
the pitching moment vary between —8° and 15° for the entire trim envelope. This requirement falls well 
within the elevator authority from —30° to +20°, so there is no issue in this case. However, Fig. |4(b)| and 


4(c) show the situation that occurs when the stabilizer is fixed at 6° and 8° nose down, respectively. The 


pitch up moment generated by these stabilizer positions requires elevator deflections beyond the maximum 
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(d) full flaps, gear and spoilers at 13,000 ft 


Figure 3. V, 7 trim (blue) and maneuvering (yellow) envelopes of ACT model in differenct configurations for 
bank angle </> = 0 and sideslip angle (3 = 0. 10% uncertainty included for the maneuvering envelope. The black 
triangle corresponds to the current flight condition of the aircraft during the simulation. 
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limit at ^e max = 20°, and this additional input constraint significantly decreases the size of the trim envelope. 
For level flight 7 = 0°, the conventional maximum airspeed of V = 180 m/s is reduced to V = 140 m/s for 
ih = —6°, and V = 100 m/s for ih = —8°. This is important information that may significantly increases 
crew situational awareness. 





airspeed [m/s] 


(a) i h = 0° (b) i h = -6° (c) i h = -8° 

Figure 4. V, 7 trim envelopes of the ACT model for different stabilizer positions, with bank angle cj) = 0 and 
sideslip angle /3 = 0. Elevator saturation limits are —30° and +20°. 




G. Maximum bank angle calculation 

The maximum bank angle is calculated by finding the angle at which the remaining vertical component 
of the maximum achievable lift vector (with respect to a) is still able to balance the weight of the aircraft. 
This means that banking the aircraft at the current airspeed beyond this maximum angle will result in a 
stall. The concept is illustrated in Fig. 0 and the corresponding calculation is 

±</>max = ± min \ arccos ( , ] , 35° > , (6) 

l V^max /2P V 2 S COS')) ) 

where C l L max = Cl 0 + C'L a a max . In this calculation, the current values for airspeed V and flight path angle 
7 are used, along with the up-to-date values for Cl 0 and Cj Ja provided by the identification algorithm. The 
maximum angle of attack a max is further assumed known, but in principle it too could be updated from 
existing sensor data. Finally, Eq. ([6]) also reflects the fact that for a conventional civil airliner, the maximum 
bank angle does not typically exceed 35°. 



Figure 5. Force balance between lift and weight in a turn 


The critical aspect of the calculation is that the bank angle limits ±</> max become increasingly restricted as 
the aircraft slows to the stall airspeed — and at stall speed, no bank authority remains. In an icing scenario, 
one expects the maximum lift capability of the aircraft, established by the value of Ci max , to decrease, while 
the total aircraft weight W remains the samejfl As a consequence, cos <^ max increases, which results in a 
decrease of 0 max . Some typical values for the ACT model without icing are shown in Table [T| 


IAS [kts] 

«[°] 

^max [°] 

222 

4 

± 

70 

161 

9 

± 

45 

142 

15 


: 0 


Table 1. A few typical values for the maximum bank angle at different airspeeds, computed for the ACT 
model. 


H. Computational efficiency 

The above methods for system identification, trim envelope estimation, and maneuvering envelope estima- 
tion are computationally efficient enough to dynamically re-recompute as aircraft conditions change, or to 
compute extended envelopes by sweeping over values for f and /3. For example, with the resolution setting 
used to generate the envelopes in Fig. [3] the system identification step took about 20 ms, the trim envelope 
estimation step took 80 ms, and the maneuvering envelope estimation step took about 2 s. The additional 
computational cost required for the pitching moment control and bank angle limit calculations is negligible. 
The calculations were performed on a 2.6 GHz MacBook Pro laptop computer. 

III. Communicating the envelope information to the crew 

The envelope information derived in the previous section may be useful to the control system, the 
automation system, and to the crew. In this section one approach designed to enhance crew awareness 
through existing displays and symbology is discussed. Subsection [A] cover the conversion of the trim and 
maneuvering envelope information into airspeed and vertical speed markers for use on the primary flight 
display (PFD). Sections iBl and [Cl then discuss how the maximum pitch and bank angle information are 
presented on the PFD, respectively. 

A. Mapping envelope information to PFD limit indicators 

Due to the nonlinear nature of the underlying dynamics model, the calculated trim and maneuvering en- 
velopes are defined by two-dimensional non-convex sets that inherently contain more information than can 
be represented by one-dimensional limit indicators on the PFD. Nonetheless, the PFD is the essential tool 
for effectively conveying the most important envelope information to the pilot. 

A straightforward approach is to generate PFD indicators based on the current aircraft state and config- 
uration (flaps, gear, speed brakes, and stabilizer position). The goal, then, is to display the minimum and 
maximum safe indicated airspeeds at the current flight path angle , as well as the minimum and maximum 
steady-state (or maneuvering) vertical speeds at the current airspeed. The situation is depicted in Fig. [6] 
With the current aircraft state at A, corresponding to a particular (Wrntj 7crnt) pair, the minimum and max- 
imum airspeeds are obtained from the subset of estimated trim points with 7 = 7 crn t, while the minimum 
and maximum steady state flight path angles are found from the subset of trim points with V = Wrnt- An 
analogous process is used to find the remaining extremal points for the maneuvering envelope as shown in 
the figure. Of course, the true airspeed (TAS) envelope boundaries are first converted to indicated airspeed 
(IAS) by accounting for air density before they are displayed on the airspeed tape on the left side of the 

a In some icing scenarios it is possible for the weight of the aircraft to increase with ice accretion. The incorporation of this 
aspect requires further online estimation of the aircraft weight, which is not a topic explicitly covered in this paper. 
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PFD. Likewise, the flight path angle 7 limits are translated into vertical speed h for presentation on the 
vertical speed tape on the right hand side of the PFD. 

As described so far, this algorithm will work provided the (Wrntj 7crnt)-state falls well within the trim 
envelope. However, when this is not the case then the algorithm may fail to convey sensical information to 
the pilot. One such example, among many, occurs if the aircraft state is at location B, as shown in Fig. [G] 
In this case the trim envelope airspeed range does not exist because there are no trimmable airspeeds at the 
current flight path angle. To remedy situations such as this, our approach was to first establish an inside 
trim box, and then to always project the current aircraft state onto the box, as shown for point B in Fig. [Gj 
before calculating the mapping to the PFD limits discussed in the previous paragraph. 



Figure 6. With the current aircraft state inside the trim envelope on the right side at A, the edges of the trim 
and maneuvering envelope are found and mapped to the PFD as follows: ( * ) stall speed limit, ( ** ) structural 
overspeed limit, (m) minimum steady-state vertical speed, ( ir) maximum steady-state vertical speed, (v) 
minimum maneuvering vertical speed, and (vi) maximum maneuvering vertical speed. If instead, the current 
aircraft state is outside the trim envelope box at B, then the state is first projected onto the inside trim box 
prior to determining the PFD envelope limits, as described in the previous sentence. 


When displayed in the manner shown in Fig. [Gl the airspeed information is consistent with operational 
practice. Stall speed and overspeed are indicated by the red barber poles. The amber brackets have another 
specific meaning. The top of the lower amber bracket indicates the minimum speed at which a 35° bank angle 
can be established without stalling the aircraft. When the airspeed falls within the lower amber bracket, 
then only bank angles less than 35° are sustainable; and near the stall speed no bank angle is safe. On 
the other hand, the bottom of the upper amber bracket marks the maximum permissible airspeed at the 
next flap setting. Therefore, if the airspeed is in this upper amber region, then flap deployment to the next 
setting is unsafe. Current PFD technology, relies on a pre-calculated database, stored on-board, for this 
information. Table [2] shows the pre-computed maximum flap speeds (structural speed limit, at which the 
flaps are retracted automatically, the overspeed marker takes into account a safety buffer) used for the ACT 
model as an example. The technology developed in this paper, however, enables the online estimation of the 
limit information from the trim and maneuvering envelope calculations for the current aircraft configuration. 
This online information can be of critical importance in hazardous conditions such as icing. 

The safe vertical speed limits displayed on the vertical speed tape provides new information, not available 
in current PFD technology. Like the airspeed tape limits discussed in the previous paragraph, the vertical 
speed limits are also conveyed using amber and red bands, indicating caution and danger, respectively. 
However, the reason that a particular aircraft state may be unsafe is of course different than it would be for 
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Flaps 

overspeed marker IAS [kts] 

automatic flap retraction IAS [kts] 

1 

240 

278 

5 

220 

232 

15 

210 

220 

20 

195 

215 

25 

190 

210 

30 

162 

198 


Table 2. Typical pre-calculated IAS values for the flap dependent overspeed limits of the ACT model 


the airspeed tape. On the vertical speed indicator, the amber regions mark the vertical speed ranges where 
no equilibrium can be established. In practice, this means that airspeed speed will increase in the lower 
amber region, even for idle thrust, and that airspeed will decrease in the upper amber region, even with full 
thrust. The red barber poles mark the regions outside of the maneuverability envelope. In practice, this 
means that it is impossible to return from this region to a trimmable aircraft state within 5 s. 

As with current technology, the operational use of the new limit information requires a safety buffer so 
that pilots have a chance to respond, before potentially loosing control of the aircraft. For the technology 
discussed in this paper, the appropriate margins are achieved by including margins in the limits of the range 
of possible values for the virtual inputs, which ultimately drive the envelope limits provided to the PFD. For 
the angle of attack a, a safety margin of 2° was provided, reducing the standard range a G [0; a s t a ii] to the 
restricted safe range a G [0; a s taii — 2°]. For the elevator deflection S e an analogous safety margin of 1° was 
provided, resulting in S e G [d 6min + 1°; d emax - 1°]. 


1. Improving the envelope limit resolution 


If the resolution used to compute trim envelope point grid is coarser than desired for the limit displays, 
then this can be improved for the specific trim envelope points used to drive the PFD indicators without 
significantly increasing the computation time through the use of a simple bisection method. For example, 
given a coarse calculation for I4taib and trim envelope calculation resolution Aid, one can iterate 


Fstall 
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for k = 1, 2, . . . , r, and after r iterations, I^taii is inside the trim envelope and Id sta ii — AV/2 r is not. Recall, 
I is the indicator function defined by Eq. ([5j). The appropriate version of this example can then be used 
to compute any trim envelope related limit to the improved resolution (AV/2 r , A r y/2 r ). This approach is 
significantly more efficient than computing all the points in the trim envelope at the higher resolution. 


B. Indication of the maximum pitch attitude angle 

The conventional maximum pitch attitude angle 0 max maker position is yet another output provided by the 
envelope estimation algorithm. The marker corresponds to the pitch attitude angle 9 where stall will occur. 
Since pitch attitude is 9 = 7 + a, its maximum value is given by 

9 max = ^current T Ost.all . (7) 

This indicator tells the crew the pitch attitude angle that stalls the aircraft. Its expected use is primarily 
for manual flight operations. 


C. Indication of the maximum bank angle 

Maximum bank angle limits are provided along side the regular bank angle indicator on the PFD, as seen 
in Fig. [3 which is similar to the Airbus style PFD. The red bank markers show where stall will occur. 
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The yellow bank markers are fixed at tj> = 35°, since nominal bank maneuvers for commercial aircraft stay 
within these bounds. However, as the aircraft slows, <f> max eventually becomes less than 35°, and in this case 
the yellow markers collapse together with the red markers, as shown in Fig. 7(c) until no bank authority 
remains when the aircraft reaches the stall air speed. 



(a) indicated airspeed 222 kts (b) indicated airspeed 161 kts (c) indicated airspeed 142 kts 


Figure 7. Maximum bank angle 0 max of FLTz ACT model for different indicated airspeed values. No bank 
authority is left close to stall speed. 


IV. Experiment method for the piloted simulation study 

The overall objective for the simulation study was to examine how crews managed their trajectory and 
energy state, both with and without new technologies, while interacting with the flight deck automation 
during relevant scenarios with air traffic control and other air traffic. Since the study involved several 
new technologies and a limited number of test subjects, its purpose was exploratory and its outcome was 
intended to guide future research and development efforts to elevate technology readiness. This section 
presents elements of the experimental method specific to the safe flight envelope aspect of the study. The 
details of the overall experiment are discussed separately in Ref. [19] 

A. Technologies 

In all, three new technologies were evaluated in the study: 

1. Trajectory prediction. The Navigation Display (ND) and Vertical Situation Display (VSD) included a 
trajectory prediction with active drag estimation that shows the future trajectory of the aircraft out to 
5 minutes if no action is taken by the pilots. An example is shown in Fig. [5] The magenta line shows 
the programmed FMS route through the waypoints. The green line in both displays is the trajectory 
prediction. 

2. Envelope estimation. On-board characterization of the safe maneuvering envelope, as presented in m 
and m above. 

3. Predictive alerting. Combines the previous two new technologies to generate predictive alerts from an 
analysis of the trajectory prediction with respect to the maneuvering envelope. The predictive alerts 
were then displayed on the Engine Indication and Crew Alerting System (EICAS) display, ND, and 
VSD. Three types of alerts were provided: advisories for expected conflicts in 45 s were shown in white 
text on EICAS and in blue on ND/VSD, yellow caution messages alerted for conflicts in 10 s, and 
red warnings indicated imminent danger. Example EICAS and ND displays with predictive alerts are 
shown in Fig. [9] 

See Refs. [T9] and (2D1 for more information about the new trajectory prediction and predictive alerting features. 
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The baseline display configuration for the study was the conventional cockpit configuration without any 
of the above new technologies. The VSD, without the green trajectory prediction was also considered part 
of the conventional cockpit configuration, despite the fact that many test subject pilots were not familiar 
with this kind of display. 



(a) Navigation Display with predicted trajec- (b) Vertical Situation Display with predicted tra- 
tory jectory 


Figure 8. Predicted trajectory information on the flight deck 



(a) Engine Indication and Crew Alerting System (b) Navigation Display with predictive alerting 
display with predictive alerting 


Figure 9. Predictive alerting information on the flight deck 


B. Scenarios and procedures 

Four challenging descent scenarios were designed for the study, all of which were inspired by relevant air 
accidents and incidents from the aforementioned CAST studyP The scenarios were flown in a randomized 
order designed so that half the pilots flew with the baseline technology first, and the other half flew with the 
new technology first. Two of the scenarios were relevant for the envelope research. These were the icing and 
the unscheduled stabilizer trim scenarios detailed below. In the the icing scenario, higher minimum airspeeds 
were required to prevent stall, while in the unscheduled stabilizer trim scenario, lower maximum airspeeds 
prevented elevator saturation. Information about the two other scenarios not discussed here is available in 
Ref. nn 

Prior to beginning the evaluation, the pilots were given a one hour briefing that covered an overview to 
the experiment, its objectives, as well as the baseline and new technologies. The crews were made aware 
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they would be flying challenging descent and landing scenarios, but no specific details were provided. The 
pilots were also given an hour for two training runs in order to gain some familiarity with the simulator, 
aircraft model, and experiment procedure. 

Each test scenario was initialized with the autopilot and flight management system (FMS) completely 
preprogrammed. The pilot flying had the choice to navigate by means of the FMS, the mode control panel 
(MCP), or manually, as he deemed appropriate in the scenario at hand. Prior to the start of each simulation 
run, the crew was given an ATC clearance, and was subsequently vectored by air traffic control during their 
approach. The simulations included other air traffic as well. 

1. Icing scenario 

In specific atmospheric conditions, ice accretion is possible on the aircraft wings. In this scenario, it was 
assumed that the regular thermal anti-ice systems, which are conventional equipment on all civil airliners, 
were operating but were incapable of removing the ice build up on the wings. The goal of this scenario, 
then, was to see how wing icing impacts the maneuvering envelope, and to see if displaying the new envelope 
information to the pilots helped them to maintain safer flight operations. 

In this scenario, the aircraft was initialized in an icing condition with modified flight dynamics. Ice 
accretion on the wings causes the wings to provide less lift, to experience more drag, and to stall for smaller 
angles of attack. To simulate these effects, the lift and drag curves for the aircraft were modified as shown 
in Figs. |10(a)| and |10(b)| 




(a) Effect of icing on lift (b) Effect of icing on drag (c) Modified standard instrument ar- 

curve curve rival (STAR) over BLUZZ to RW18L 


Figure 10. 


At the start of the simulation run, the flight crew was informed about the icing condition by an ‘icing 
wing’ caution message shown on the EICAS display. The top left corner of this display also showed that 
Thermal Anti-Ice (TAI) was working. The aircraft was set up to fly the published profile along the BLUZZ2 
STAR arrival to runway 18L, as shown in Fig. 10(c) Deceleration segments were included in the STAR 


ahead of waypoints COPEN, VNSSA and HEXIN. As a consequence of the icing, there were larger than 
expected speed overshoots during the deceleration segments. At waypoint VNSSA, there was a deceleration 
to 210 kts in combination with a turn, followed by a further deceleration to 170 kts at HEXIN. At both 
of these waypoints, there was the potential for stall to occur, unless the crew deployed flaps earlier than 
expected for nominal scenarios. 


2. Unscheduled stabilizer trim scenario 

Another scenario considered in this study, was an 8 degrees nose down unscheduled stabilizer trim position 
(the maximum value in flight), which generated a pitch up moment. The aircraft was initialized in this 
condition. The disturbing moment then had to be counteracted by the elevators, which came close to their 
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saturation limits, especially during a go-around. This resulted in significantly stricter upper envelope limits 
on speed and climb rate. 

At the start of the run, the flight crew was informed of the stabilizer issue, by an ‘unsched stab trim’ 
EICAS message. The lower EICAS display showed the nose up stab trim at 8° and a compensating elevator 
deflection of more than 14°, which was close to the saturation limit of 15°. The BRBBQ2 STAR arrival 
to runway 18R was flown in this scenario, as shown in Fig. 11(a) At waypoint SAAMM, the flight crew 
received an ATC instruction to go-around due to traffic on runway, shown as phase ® in Fig. |ll(b)| The 
pilot performed a go-around by increasing thrust and establishing a positive rate of climb with gear up in 
phase (2). There were three options available for the execution of the go-around: using a switch on the 
MCP, flying manually but using auto-throttle in takeoff/go-around (TOGA) mode, or full manual control 
for side-stick and throttle. This flight regime (high speed, high thrust, steep climb), combined with the 
nose down stabilizer trim position caused a large pitch-up moment that risked exceeding of the pitch-down 
elevator authority at (3). As a consequence, the maximum speed and climb rate should have been limited 
during go-around to avoid elevator control saturation. 



(a) Modified standard instrument arrival (b) Sequence of events during go-around 

(STAR) over BRBBQ to RW18R 


Figure 11. Setup of the unscheduled stabilizer scenario 


C. Apparatus 

The Advanced Concepts Flight Simulator (ACFS), shown in Fig. [T2l is a six degree-of-freedom research flight 
simulator with configurable flight deck instrumentation systems, a 180° field of view outside visual display 
system, a hydraulic motion system, as well as digital sound and aural cueing systems!- 21 ! 

1 . Flight Deck Instrumentation 

The flight deck was set up to resemble a generic two-person cockpit of a widebody airliner. The installed 
hardware consisted of two aircraft seats, hydraulically actuated sidesticks, rudder pedals, a control pedestal, 
six large and two small LCD screens to display the flight instruments, and a Boeing style mode control panel. 
The displays were based on the B767-300 electronic flight instrumentation system and were rendered using 
OpenGL running at a 60Hz refresh rate. 

2. Outside Visual System 

The out-the-window visual scene was provided by a Flight Safety Vital X PC-IG system, configured with 
SkyLight 1500 raster/calligraphic projectors in three channels. The resulting system produced a seamless, 
edge-blended, cross-cockpit image with a 180 degree horizontal and 40 degree vertical field-of-view. Day, 
dusk, and night scenes were available with databases and weather simulation capabilities as required. The 
projector refresh rate was 60 Hz. For this evaluation, a visual representation of Memphis International 
Airport was used. All runways and major taxiways were in their correct location, along with the most 
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(a) Outside view (b) Cockpit view 


Figure 12. Advanced Concepts Flight Simulator at NASA Ames Research Center 


important buildings on the airfield. The surrounding area was kept simpler, with a textured ground plane 
showing a rough outline of Tennessee. 

3. Motion System 

The motion cues were provided by a six degree-of-freedom synergistic system. The hydraulic servo-actuated 
system was originally designed to meet or exceed the performance specified by MIL-STD-1558 for the rated 
payload. 

D. Participants 

Twenty commercial airline pilots (from three different carriers) participated as ten two-person crews, with 
each crew consisting of pilots from the same carrier. The participating commercial flight crew members were 
between 43 and 61 years old, with an average age of 56 years. Their flight hours were between 6,000 and 
23,000, with an average of 14,700 hrs. All of the crew members were either current on the Boeing 757/767, 
or had flown this type of aircraft earlier in their career. 

V. Results 

Given the exploratory nature of the experiment and that several technologies were evaluated it is not 
possible to provide strong statistical conclusions on any particular aspect of the experiment, but the data 
was sufficient to observe certain trends. The evaluation results for the icing scenario are discussed first in 
subsection El and the unscheduled stabilizer scenario is analyzed in subsection [B] In each subsection, the 
results from one particular crew are discussed first, and are then followed by a performance analysis that 
covers all of the crews together. 

The envelope limits for both current technology and new technology displays are discussed in this section. 
Current technology display limits are a function of flap setting only and are read from precomputed data 
tables stored onboard the aircraft. The new technology limits are updated online based on sensor and system 
identification information in addition to aircraft configuration changes, which include flap setting, bank angle, 
gear position, speed brake extension, and stabilizer position. The new technology limits therefore represent 
actual limits for the flight condition of the aircraft, and are referred to as actual limits in the discussion 
below. It is understood that the actual limits are still estimates in this context. 
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A. Icing scenario 

The envelope bounds for IAS and bank angle are shown in Fig. [13] for a particular approach trajectory under 
icing conditions. The x-axis is plotted with respect to along track distance (ATD), so that one can observe 
the impact of the deceleration segments, discussed in ^livlem on the actual vertical path. The two graphs in 
the left column show the path flown with current technology. For current technology scenarios, the magenta 
lines indicate the airspeed limits presented to the crew, which are based on precomputed data tables that do 
not account for the the influence of icing. The red airspeed and bank limits are the actual limits computed 
by the envelope estimation method discussed in this paper. These actual limits are not displayed on the PFD 
for the current technology scenarios. Conversely, the graphs in the right column represent new technology 
scenarios, where the actual airspeed and bank angle limits, accounting for the influence of icing, are displayed 
on the PFD for the pilots. The solid red lines on the IAS graphs correspond to the stall airspeed limit, taking 
into account a safety buffer of 2° for the stall angle of attack a sta ii- The dashed lines on the IAS graphs 
show the maneuvering limits, defined as the speed where stall will occur in conjunction with a 35° bank. 
The dashed lines on the bank angle plots are fixed at 35°, while the solid red lines represent the bank angle 
where stall will occur for the current airspeed. One may further observe in Fig. 13(c) that the solid bank 
angle limit lines overtake the dashed limit lines when the indicated airspeed exceeds the maneuverability 


speed limit shown in Fig. 13(a 


As one should expect, the maneuvering and stall speed limits for the new technology scenarios are 
significantly higher due to the influence of icing. Higher speeds are required in turns to compensate for 
the reduced vertical component of the tilted lift vector. It can be seen in the current technology scenario 
that the crew approached the actual stall speed much closer without knowing it. The second deceleration 
segment and simultaneous banking brought them to the verge of stalling (taking into account the safety 
buffer) without being aware of it. The third deceleration segment brought them very close to stall again, 
but flaps were deployed just in time to avoid it. In the bank angle graphs, one further observes that speed 
variation and flap deployment, affecting Cx max directly, have a direct influence on the maximum bank angle. 
In the new technology graphs, the crew clearly relied on the more accurate maneuvering and stall speed 
limits to stay further from stall limit, and to even secure the full 35° bank authority for nearly the entire 
duration of the flight. 

Figure 14(a) shows the margin between the current IAS and the stall limit V m i n , in addition to the margin 
between the current angle of attack a and the safe limit angle of attack a sa f e , which is 2° smaller than a s taii- 
The a-margin includes the influence of the flap setting on the stall limit, shown in Fig. |14(b)| This figure also 
shows that, as a general rule, a increases during deceleration segments and decreases with flap deployment. 

The bar plot appearing in Fig. [15] shows the minimum airspeed and angle of attack margin that occurred 
across the full simulation run for each individual crew. Within each plot, the set of bars on the left cover 
the runs with current technology, and the set of bars on the right cover the runs with new technology. For 
example, Fig. |l4(a)| shows that crew A violates the limits briefly with current technology, but maintains 
a significant margin with new technology. Analyzing the data for all of the crews shows that six out of 
ten crews exceeded the limits with current technology, without being aware of it. On top of each set of 
bars, the average and standard deviation across the bars are indicated. The standard deviation values were 
further corrected for variability between subjects. Figure [151 confirms that, looking at the whole test group, 
more safety margin is maintained with respect to the envelope boundaries when the new technologies were 
available. These results are statistically significant, but one has to take into account that the test group 
consists of only 10 crews. 

The flap deployment strategy in the icing scenario is shown in Fig. 1161 This figure shows the average 
indicated airspeed for each flap setting over the entire simulation run, for all crews. The standard deviations 
were corrected for variability between the individual subjects. Comparing strategies with and without new 
technology, shows that the crews deployed flaps at higher speeds with technology, since they were aware of 
the actual stall limits accounting for the influence of icing. 

Summarizing for the icing scenario, the safe envelope boundaries presented to the crews, were consistent 
with maneuvers and airplane configuration changes (intentional as well as unintentional). When the safe 
envelope boundaries were presented to the crews, they adapted their flap deployment strategy. By deploying 
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bank angle (deg) IAS (kts) 


Crew A icing scenario without technology Crew A icing scenario with technology 




(a) IAS current technology (b) IAS new technology 


Crew A icing scenario without technology 



Crew A icing scenario with technology 



(c) bank angle current technology 


(d) bank angle new technology 


Figure 13. 
<j> for icing 
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evolution of envelope lower bounds of indicated airspeed Vias and bank angle 
of current technology and new technology for crew A. 
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Figure 14. Along track distance evolution of indicated airspeed and angle of attack margins for the icing 
scenario with current and new technology, crew A. 
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Figure 15. Statistical analysis of minimum margins to envelope boundaries for icing scenario, all crews 
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Flap deployment strategy for icing scenario 



IAS (kts) 


Figure 16. Flap deployment strategy in icing scenario, all crews 


flaps earlier in the descent for higher airspeeds, they maintain significantly larger safety margins to the actual 
flight envelope boundaries for the aircraft with wing icing. 

B. Unscheduled stabilizer trim scenario 

The results for the unscheduled stabilizer scenario provided a number of insights into the relevant dynamics 
and effect of the envelop limit indicators during a go- around maneuver. 

Figure QT] shows the time histories of the envelope upper bounds for IAS and climb rate in the go-around 
part of the unscheduled stabilizer scenario. As with the icing scenario, the two graphs in the left column 
show the path flown with current technology. For current technology scenarios, the magenta lines indicate 
the airspeed limits presented to the crew on the PFD. These are based on precomputed data tables that 
do not account for the influence of the unscheduled stabilizer. The red speed and climb rate limits are the 
actual limits, which are not displayed on the PFD for the current technology. The graphs on the right hand 
side represent the new technology scenario, where the actual limits for speed and climb rate are displayed 
on the PFD, taking into account the influence of the stabilizer position. The solid limit line in the speed 
graph corresponds to the overspeed limit, taking into account a safety buffer of 1° for the elevator deflection 
S e . The dashed limit line in the speed graph is the overspeed for the next (higher) flap setting. The dashed 
limit in the climb rate graph represents the flight condition where the throttle saturates providing maximum 
thrust T max . Higher climb rates h will lead to a loss in indicated airspeed IAS. The solid line represents the 
flight condition from where it will take at least 5 s to reach a steady state flight condition, or which will take 
at least 5 s to be reached starting from any steady state flight condition, or where control authority is lost. 
For example, in the unscheduled stabilizer scenario, the red line marks where the elevator will saturate, and 
thus cannot compensate any longer the moment induced by the misaligned stabilizer, which then results in 
an uncontrollable pitch up moment. 

Referring back to Fig. [1] one expects significantly lower overspeed limits due to the influence of the 
stabilizer. For current technology, the displayed speed limits vary only with flap setting, while the new 
technology limits are more accurate because they account for things like variation in speed and climb rate, 
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as shown in Fig. [I] In the current technology scenarios, one may observe that the crew got much closer to 
the actual overspeed limit without knowing it. Just before selecting flaps 15, the crew came to the verge of 
overspeeding at the flaps 25 setting (taking into account the computational safety buffer and the structural 
buffer) without awareness of the additional aircraft limitation at that setting. Selecting flaps 15 helped them 
to increase their speed and climb margin, however it is not clear if this action was intentionally taken with 
this purpose in mind. 

In the vertical speed graphs, the maximum climb rate is directly influenced by speed variation (higher 
maximum vertical speed for higher speeds) and flap retractions (significant reduction in maximum climb 
rate for flap setting 5 and less). The huge dip in the climb limit in Fig. 17(c) is the consequence of exceeding 
the overspeed limit in Fig. 17(a) since this is a two dimensional upper limit for speed and climb rate, as 
shown in Fig. [I] Especially for the new technology, it can be seen that there is no significant speed increase 
in Fig. |17(bJ| when the vertical speed exceeds the steady climb limit in Fig. |17(dJ| However, this trend is less 
apparent when one compares Fig. 1 17(a)] and [l7(c)| The new technology graphs show that the crew relied on 
the more accurate overspeed limits. They exceeded the maximum steady climb limits only marginally, and 
this did not seem to lead to any unsafe situations during the go-around maneuver. 

FigureHHfocuses on the margins of the indicated airspeed to its overspeed limit H max , the vertical speed h 
to its maximum value /i max , and the input elevator deflection S e to <5 emax , which is considered 1° smaller than 
its real value as a safety buffer. The elevator deflection 5 e signal contains high frequency components, and is 
directly steered by the pilot when in ‘command’ (CMD) mode, or otherwise in autopilot (AP) mode. In order 
to compare this signal meaningfully with indicated airspeed and vertical speed (which depends on flight path 
angle 7 and speed) margins in similar bandwidth ranges, the elevator margin needs to be low-pass filtered 
with the appropriate time constants of a.o. 7 . The figure shows that in the current technology scenario, when 
indicated airspeed and vertical speed boundaries are violated, then the elevator safety limit is exceeded as 
well. However, elevator saturation can also occur without any violations of IAS and h limits, as one can 
observe around t = 1020 s and t = 1060 s. Data analyses of other participants lead to similar observations. 
Exceeding the IAS and h bounds also does not necessarily imply that the elevator will saturate. There are 
a few possible explanations for this observation. The additional trim criterion, in this specific context, uses 
the higher bandwidth pitching moment M from time scale separation diagram in Fig. 1(b) | M oreover, the 
envelope boundaries for this trim criterion are calculated according to the discussion in illllFl which relies 
on the corresponding trim values of the virtual inputs a and T for every steady state flight condition V, 7 . 
However, the go-around maneuver is very dynamic an as such requires actual inputs for a and T that may 
differ significantly from the values required to hold a trim condition. Also the accuracy of the identified 
values for the aerodynamic coefficients related to the dimensionless pitching moment coefficient C m during 
the dynamic go-around maneuver may play a role in this context. This is a topic for further research. 

The bar plot in Fig.[l9]shows the minimum margins to the saturation limit of the elevator deflection S e for 
the go-around portion of the simulation run for each individual crew. This was done for current technology 
on the left, and for new technology on the right. Due to the complexity of options crews made a variety of 
different decisions that would have affected the results. For example, crew B violates the limits with current 
technology, but maintains a small margin with new technology, see Fig. 1181 The statistical analysis of the 
margins for IAS and h was not included since there was no accurate and consistent link with the elevator, 
which is in contrast to the margins for the icing scenario. With respect to the margins maintained for IAS 
and h, the data also show a significant learning effect between first and second run, irrespective of which 
technology is considered first. Analyzing data for all crews and comparing current technology versus new 
technology shows that six out of ten crews improved their minimum margins to elevator saturation, while 
three crews decreased their margins. For one crew there was barely a difference. On top of the bar plots, 
the average values are indicated as well as their standard deviations, which were corrected for variability 
between subjects. Figure [T9] confirms that, looking at the whole test group and despite the earlier side-notes, 
more safety margin is maintained with respect to the saturation limit with new technologies. 

The climb out profile in the go-around phase of this scenario is shown in Fig. [5D] This figure shows the 
average along track distance for each 500 ft of altitude change during the go-around, for all crews. The 
standard deviations were corrected for variability between the individual subjects. Comparing the average 
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Figure 17. Time histories of envelope bounds of indicated airspeed Vias and vertical speed h for unscheduled 
stabilizer scenario during go-around, comparison of current technology and new technology for crew B. 
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Margin to overspeed and overclimb post go around point 




Figure 18. Time histories of indicated airspeed, vertical speed and elevator deflection margins during go-around 
for the unscheduled stabilizer scenario, crew B 
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Figure 19. Statistical analysis of elevator margin to deflection limit during go-around for unscheduled stabilizer 
scenario, all crews 
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flight profile post go around point 



Figure 20. Climb out profile during go-around maneuver, all crews 


ascent trajectories in Fig. m with and without technology, shows that the crews had a reduced (safer) 
average climb rate with technology, since they were aware of the actual overspeed and steady climb rate 
limits that reflected the influence of the stabilizer. 

The variety of outcomes evident in Fig. [T9] along with the variability that appears in Fig. [20] can be 
attributed to the following factors. First, as mentioned in 1 1IVIBI2I pilots were able to choose between three 
methods for controlling the go-around: manual steering, full autopilot control with the TOGA-switch on the 
MCP, or just auto-throttle with the TOGA-switch on the throttle levers. In addition, the execution of a 
go-around is a very procedural maneuver where pilots focus on a small number of specific aspects, such as 
thrust setting, establishing a positive rate of climb, gear and flap retraction, etc. Attention was not typically 
placed on aspects of secondary importance. Furthermore, only a few of the participants were successful at 
interpreting the updated safe envelope limits and understanding the reason for the stricter overspeed limit. 
Others were perplexed by the limits and one crew thought they were caused by a software error. This was 
an unintended consequence of the conscious decision not to brief specific aspects of each scenario in order to 
observe if the new limit displays were intuitive. 

In spite of the factors contributing to the variability in the observed data, when the safe envelope bound- 
aries were presented to the crews, most of them adapted their climb out profile. By reducing airspeed and 
climb rate, they maintained larger safety margins to the trim envelope boundaries and by doing so avoided 
loss of control over the aircraft pitching moment. 

C. Pilot Feedback 

From the answers in the pilot questionnaires, the following observations were made. The envelope limits 
increased awareness of events as well as aircraft energy. When rating the envelope information in order of 
usefulness, the crews preferred the airspeed limits above all others. The bank angle limits ranked second 
and the vertical speed limits were third. The vertical speed limits were also the smallest and newest aspect 
added to the PFD, and a few pilots commented to that effect. 
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VI. Conclusion 


In past research, an online safe flight envelope estimation system was developed. Section [XT] presented the 
approach, which combined rapid system identification, trim envelope estimation, and reachability analysis to 
determine sets of safe airspeeds and flight path angles from aerodynamic sensor information, current aircraft 
configuration, and the physics of flight dynamics. The outcome of the research was a source of information 
meant to enable safety assurance for control, automation, and crew systems. 

Focusing on the crew system, the work presented in this paper developed an approach for transforming 
the safe flight envelope information into limit indicators for the PFD. The approach presented in section Hill 
leveraged current flightdeck indicator symbology to drive limit indicators for the airspeed and vertical speed 
tapes, which were further tied to new envelope driven bank and pitch limit indicators. The novel aspect of 
the approach was the method for driving the indicators from online envelope estimates, not the indicators 
themselves. 

The integrated envelope estimation and limit displays were then implemented in a full motion simulator 
and tested by ten commercial crews flying relevant and challenging approach scenarios, as described in section 
UY1 The results discussed in section [V] demonstrated that for the icing scenario the new information provided 
by the envelope estimation technology was critical and enabled the crews to avoid low energy approaches, 
while for the unscheduled stabilizer scenario the new information helped pilots maintain safe higher energy 
operations. The pilots adapted their strategy based on the envelope information. In the icing scenario, flaps 
were deployed for higher speeds, which increased the safety margin to the boundaries of the trim envelope. 
In the stab trim scenario, the average climb during the go-around became shallower. 
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